Describe the bug

Since microsoft/vscode#259089 was introduced the Remote MCP OAuth Protected Resource implementation is failing due to a mismatch in our documented URL, https://api.githubcopilot.com/mcp/ and the resource defined in the metadata at https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp. These should match exactly with the URL used for the MCP server.

We (GitHub) are aware of this issue and working on a fix but for the moment there are some workarounds:

• Use https://api.githubcopilot.com/mcp instead of https://api.githubcopilot.com/mcp/.
• For MCP servers with limited toolsets or read only toolsets use the X-MCP-Toolsets and X-MCP-Readonly headers instead of the URL endpoints.
  • i.e. Instead of https://api.githubcopilot/mcp/x/issues/readonly, set the X-MCP-Toolsets: issues and X-MCP-Readonly: true

  {
    "servers": {
    	"github": {
    		"type": "http",
    		"url": "https://api.githubcopilot.com/mcp",
    		"headers": {
    			"X-MCP-Toolsets": "issues",
    			"X-MCP-Readonly": "true"
    		}
    	}
    }
  }

x-ref: microsoft/vscode#259251